Skip to content

chore(deps): update Go module dependencies - #3007

Merged
mikeland73 merged 3 commits into
mainfrom
mikeland73/update-go-deps
Oct 25, 2026
Merged

mikeland73 merged 3 commits into
mainfrom
mikeland73/update-go-deps

Conversation

@mikeland73

Copy link
Copy Markdown
Collaborator

Summary

Stacked on #3006 (Go 1.27). Updates every direct Go dependency that has a newer release.

Module Old New Notes
github.com/f1bonacc1/process-compose v1.116.0 v1.122.0 Security: fixes Dependabot advisory "Browser DNS rebinding lets websites control local process-compose MCP tools" (< 1.120.0). Bumps the library and processComposeVersion together, as TestProcessComposeVersionMatchesGoMod requires.
github.com/getsentry/sentry-go v0.36.2 v0.50.0 Builds as-is. None of the breaking changes in 0.37 to 0.50 touch our usage (CaptureEvent, CurrentHub().Recover, a custom HTTPTransport, which keeps us on the legacy transport). Skipped 1.0.0-alpha, which removes the Hub API.
github.com/segmentio/analytics-go v3.1.0+incompatible analytics-go/v3 v3.4.0 Moves to the proper module path. Track and Context only gained fields (direct, groupId), so events already buffered on disk still decode.
al.essio.dev/pkg/shellescape v1.6.0 v1.6.1
github.com/bmatcuk/doublestar/v4 v4.9.1 v4.10.3
github.com/fsnotify/fsnotify v1.9.0 v1.10.1
github.com/mattn/go-isatty v0.0.22 v0.0.24
github.com/samber/lo v1.52.0 v1.53.0
github.com/tailscale/hujson 2025-06-05 2026-07-27
golang.org/x/exp 2025-10-23 2026-10-14
golang.org/x/term, golang.org/x/text v0.46 / v0.41 v0.47 / v0.43 Indirect, but compiled into the binary

process-compose code change: types.ProcessState.Namespace is now types.Namespaces ([]string), because a process can belong to several namespaces. devbox services ls renders it with Namespaces.String(), which joins the entries with , and falls back to default. Its UnmarshalJSON still accepts the old single-string form, so ls keeps working against a daemon started by an older devbox that is still running.

Everything else either has no newer release or is already latest. survey and pkg/errors are archived, so replacing them is a refactor and out of scope here.

Test plan

  • devbox run lint: 0 issues
  • devbox run test (go test -race -cover ./...): all packages pass
  • nix build . with the updated vendor-hash
  • Manual smoke test in an isolated XDG home: devbox services up -b installs process-compose v1.122.0, devbox services ls shows the process with namespace default, and devbox services stop works
  • CI

🤖 Generated with Claude Code

mikeland73 and others added 2 commits October 23, 2026 15:52
Raise the go directive to 1.27 and move every Go toolchain the repo uses
onto it: devbox.lock (go 1.27.3), the flake (buildGo127Module on a
refreshed nixos-unstable that ships go 1.27.3), and CI, which reads the
go directive via setup-go.

golangci-lint v2.13.2 can't load Go 1.27 export data, so bump it to
v2.15.0 and gofumpt to v0.12.0. golangci-lint's requirements pull
x/mod, x/sync, and x/tools forward too.

Go 1.27's gofmt aligns one table in flakeref_test.go differently than
1.26. A blank line before the long entry makes both versions (and
gofumpt) agree.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- process-compose 1.116.0 -> 1.122.0, both the library and the binary
  installed into the utility project. Fixes the Dependabot advisory for
  browser DNS rebinding against process-compose's MCP tools (< 1.120.0).
  ProcessState.Namespace is now a Namespaces list; render it with
  String(), which joins the entries and falls back to "default".
- sentry-go 0.36.2 -> 0.50.0.
- segmentio/analytics-go v3.1.0+incompatible -> analytics-go/v3 v3.4.0
  (proper module path; Track/Context only gained fields, so buffered
  events on disk still decode).
- Minor/patch: shellescape, doublestar, fsnotify, go-isatty, lo, hujson,
  x/exp, x/term, x/text.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@claude

claude Bot commented Oct 23, 2026

Copy link
Copy Markdown

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Base automatically changed from mikeland73/go-1.27 to main October 24, 2026 23:59
…deps

# Conflicts:
#	go.mod
#	go.sum
#	vendor-hash
@mikeland73
mikeland73 merged commit 42620c5 into main Oct 25, 2026
28 checks passed
@mikeland73
mikeland73 deleted the mikeland73/update-go-deps branch October 25, 2026 00:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant